implementing-dragos-platform-for-ot-monitoring

name	implementing-dragos-platform-for-ot-monitoring
description	Deploy and configure the Dragos Platform for OT network monitoring, leveraging its 600+ industrial protocol parsers, intelligence-driven threat detection analytics, and asset visibility capabilities to protect ICS environments against threat groups like VOLTZITE, GRAPHITE, and BAUXITE.
domain	cybersecurity
subdomain	ot-ics-security
tags	["ot-security","ics","dragos","threat-detection","ot-monitoring","scada","threat-intelligence","ndr"]
version	1.0
author	mahipal
license	Apache-2.0
nist_ai_rmf	["MEASURE-2.7","MAP-5.1","MANAGE-2.4"]
atlas_techniques	["AML.T0070","AML.T0066","AML.T0082"]
nist_csf	["PR.IR-01","DE.CM-01","ID.AM-05","GV.OC-02"]
mitre_attack	["T1078","T1190","T1059","T0816","T0836"]
source	https://github.com/mukul975/Anthropic-Cybersecurity-Skills
source_commit	04450304b12645cb2b974ab96d28c0664758a88d
note	Vendored verbatim from an external Apache-2.0 security-skill library, pinned by commit. Exceeds the internal 300-line skill guideline (agent-code-constraints.md) -- kept as-is because this is vendored reference material (forensics/threat-intel procedure), not Yana AI-authored content, and trimming would damage technical accuracy.

Implementing Dragos Platform for OT Monitoring

When to Use

• When deploying an OT-specific network detection and response (NDR) solution for industrial environments
• When needing threat intelligence-driven detection against known ICS threat groups (VOLTZITE, CHERNOVITE, KAMACITE)
• When building an OT SOC capability with purpose-built industrial security tooling
• When requiring asset discovery and vulnerability management alongside threat detection in a single platform
• When integrating OT security monitoring with an enterprise SIEM (Splunk, Sentinel, QRadar)

Do not use for IT-only network monitoring without ICS components, for endpoint detection and response (EDR) on OT workstations, or for environments standardized on Claroty or Nozomi (see respective skills).

Prerequisites

• Dragos Platform license and deployment package
• Network TAP or SPAN port at OT network boundaries (one sensor per monitored segment)
• Dragos sensor hardware (physical appliance) or virtual appliance meeting minimum specifications
• Firewall rules allowing sensor-to-Dragos-SiteStore communication (encrypted, outbound only from OT)
• Dragos Knowledge Pack subscription for threat intelligence updates

Workflow

Step 1: Deploy Dragos Sensors and Configure Monitoring

#!/usr/bin/env python3
"""Dragos Platform Deployment Validator and Integration Tool.

Validates Dragos sensor deployment, checks connectivity, and
configures integration with enterprise SIEM for OT alert forwarding.
"""

import json
import sys
import csv
from datetime import datetime
from typing import Optional, List, Dict

try:
    import requests
except ImportError:
    print("Install requests: pip install requests")
    sys.exit(1)


class DragosPlatformManager:
    """Interface with Dragos Platform API for OT monitoring management."""

     ():
        .base_url = base_url.rstrip()
        .session = requests.Session()
        .session.headers.update({
            : api_key,
            : api_secret,
            : ,
        })
        .session.verify = verify_ssl

     () -> []:
        
        resp = .session.get()
        resp.raise_for_status()
         resp.json().get(, [])

     () -> []:
        
        params = {}
         asset_type:
            params[] = asset_type
        resp = .session.get(, params=params)
        resp.raise_for_status()
         resp.json().get(, [])

     () -> []:
        
        params = {: severity, : limit}
        resp = .session.get(, params=params)
        resp.raise_for_status()
         resp.json().get(, [])

     () -> []:
        
        params = {: severity}
        resp = .session.get(, params=params)
        resp.raise_for_status()
         resp.json().get(, [])

     () -> []:
        
        resp = .session.get()
        resp.raise_for_status()
         resp.json().get(, [])

     ():
        
        sensors = .get_sensors()
        assets = .get_assets()

        ()
        ()
        ()
        ()

        ()
        healthy_sensors = 
         sensor  sensors:
            status = sensor.get(, )
            icon =   status ==   
            ()
            ()
            ()
            ()
             status == :
                healthy_sensors += 

        ()

        ()
        ()
        asset_types = {}
         asset  assets:
            atype = asset.get(, )
            asset_types[atype] = asset_types.get(atype, ) + 
         atype, count  (asset_types.items(), key= x: -x[]):
            ()

        protocols = ()
         asset  assets:
            protocols.update(asset.get(, []))
        ()

        ()
        groups = .get_threat_groups()
        ()
         group  groups:
            ()
            ()
            ()

     ():
        
        configs = {
            : {
                : ,
                : ,
                : {
                    : ,
                    : ,
                    : ,
                    : ,
                    : ,
                },
                : ,
                : ,
                : [
                    , , , ,
                    , , , ,
                    , ,
                ],
            },
            : {
                : ,
                : ,
                : ,
                : {
                    : ,
                    : ,
                    : ,
                    : ,
                    : ,
                },
            },
        }

        config = configs.get(siem_type, configs[])
        ()
        (json.dumps(config, indent=))
         config


 __name__ == :
    manager = DragosPlatformManager(
        base_url=,
        api_key=,
        api_secret=,
        verify_ssl=,
    )

    manager.validate_deployment()
    manager.generate_siem_integration_config()

    ()
    notifications = manager.get_notifications(severity=, limit=)
     n  notifications:
        ()
        ()
        ()
        ()